Social engineering manipulates trust or decision-making to obtain access, information or an action. Phishing is a delivery method that uses deceptive messages or interactions, often impersonating a familiar person, service or workflow.
What it is
Phishing attempts to persuade a person to trust a deceptive interaction. The requested action may be revealing credentials, approving a sign-in, opening content, changing payment details or sharing sensitive information. Social engineering is the broader category and can occur through email, text, voice, collaboration tools or in-person contact.
The message often borrows credibility from a real workflow. A supplier invoice, account warning or document-sharing notification gives the recipient a plausible reason to act. Good grammar, a familiar logo or a valid HTTPS connection does not establish that the request is legitimate.
Explore this topic in depth
Business email compromise (BEC)5 min readHow it works
The attacker creates a pretext, delivers it through a channel the recipient uses and directs attention toward a requested action. Urgency, authority and familiarity can reduce the time spent verifying the request. The technical path varies: some messages use deceptive domains, while others come from a genuinely compromised account.
Identity and intent are separate
Email authentication can help evaluate whether a domain authorized particular mail handling. It does not tell the recipient whether the sender’s business request is honest. A legitimate mailbox can be compromised, and an attacker can send authenticated mail from a domain they control.
Different actions create different incidents
Reading a message, opening a page, entering a password, approving an authentication prompt and granting an application’s access are not equivalent events. Response should establish which action occurred and what capability it may have granted. Treating every report identically can miss important token or session consequences.
Technical references: CISA · Phishing Guidance · FBI · Business email compromise
How attackers use it
Phishing can support credential theft, malware delivery, payment fraud or unauthorized access approvals. It may be the initial step in a larger incident rather than the final objective. A convincing message can also direct a victim to a legitimate service where the requested action is still harmful.
The defender should focus on the trust decision being manipulated. If the request changes a supplier’s payment destination, the control is an independent verification process. If it asks for account access, the control includes authentication protections and careful review of the requested permission.
Warning signs
Investigate unexpected urgency, secrecy, payment changes, unusual access approvals and requests that depart from an established process. Check the actual sender and destination through trusted tools rather than relying on display text. A familiar conversation thread can still be misused if an account in that thread is compromised.
Preserve useful evidence
Retain the original message or relevant platform record, including metadata where available. Record what the recipient actually did and when. Avoid circulating suspicious content widely as a warning in a way that creates more opportunities for accidental interaction. Use the organization’s reporting channel.
Business impact
Consequences can include account misuse, fraudulent payments, information exposure and operational interruption. The impact depends on the action induced and the privileges involved. A finance workflow and a general mailing-list subscription represent very different business risks.
A supportive reporting culture improves response speed. If employees expect blame, they may delay reporting uncertainty. The objective is to gather an accurate account of the interaction quickly enough to contain its consequences, then improve the workflow that made the deception effective.
Prevention and remediation
Use phishing-resistant authentication where appropriate, protect account recovery and establish independent verification for sensitive business changes. Train people around realistic decisions rather than only spelling mistakes or visual clues. Keep reporting simple and make it acceptable to question an apparently senior request.
Respond according to the action
- For a suspicious message, preserve and report the evidence through the approved channel. - For submitted credentials, secure the account and review sessions and related activity. - For an access grant, review the granted permissions and revoke inappropriate access. - For a payment instruction, contact the responsible finance team through a trusted route. - For executed content, involve endpoint and incident responders to assess the affected device.
How Ariema detects or handles it
Ariema’s domain, DNS, certificate, mail-policy and public-web evidence can provide external context relevant to a suspicious infrastructure relationship. Published mail-policy changes and unexpected web destinations may help guide a review.
The documented product workflow does not establish mailbox inspection, employee phishing detection or identity-session analysis. Those require mail, identity and endpoint evidence. Ariema can support investigation of the related external assets without implying that a mail-policy record proves a particular message is safe or malicious.
Common questions
Does phishing always contain a malicious link?
No. A message may request a payment, a reply containing information, a phone call or an approval inside a legitimate application.
Does successful email authentication prove the message is safe?
No. A message can come from a compromised legitimate account or an attacker-controlled domain that authenticates correctly. Authentication and intent are different questions.
Should a person who clicked always reset every password?
Respond to what happened: visiting a page, submitting credentials, approving access and running a file have different consequences. Use the incident process to assess and contain the relevant exposure.
Sources & further reading
Primary technical references for this guide. Scenarios are illustrative; they are not customer observations.
CISA · Phishing GuidanceFBI · Business email compromiseOWASP · Authentication GuidanceNIST SP 800-61 Rev. 3 · Incident Response